Which products and versions are affected by CVE-2026-44825?

Affected: Solr (Apache) versions 10.0.0, >= 9.4.0; solr-9 (chainguard); lucene-solr (debian), among others. The full list is in the CVE brief.

Is CVE-2026-44825 being exploited in the wild?

It is exploited in the wild, listed in Industry KEV feed since Jul 22, 2026.

Is CVE-2026-44825 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2026-44825?

No public exploit code is known.

Is there a fix for CVE-2026-44825?

Fixed versions are available, including Solr 9.10.1, Solr 10.0.0, org.apache.solr:solr-core 9.8.1+sp999.

How urgently should CVE-2026-44825 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2026-44825

CriticalExploited

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently…

Published Jun 1, 2026 · Updated Oct 8, 2026 · Also known as BIT-solr-2026-44825, GHSA-qhr7-h655-pw6r, UBUNTU-CVE-2026-44825

Key Facts

Patch immediately

CVE-2026-44825 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Solr (Apache), solr-9 (chainguard), lucene-solr (debian) and 2 more products.
It is exploited in the wild, listed in Industry KEV feed since Jul 22, 2026. No public exploit code is known.
EPSS estimates a 2.8% probability of exploitation in the next 30 days.
Fixed versions are available, including Solr 9.10.1, Solr 10.0.0, org.apache.solr:solr-core 9.8.1+sp999.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

2.8%

Higher than 86.4% of all scored CVEs

Exploited in the wild

Yes

1 catalog listing

Public exploit code

None known

Get the full CVE-2026-44825 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.

Not affected: * Clusters where bin/solr auth enable was not used to bootstrap BasicAuth * Clusters where template users have been assigned strong passwords after bootstrap

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
Industry KEV feed	Jul 22, 2026	n/a	Not reported

Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Affected Products

14 affected entries in total

Product	Affected versions	Fixed in
SolrApache	10.0.0, >= 9.4.0	9.10.1
solr-9chainguard	See advisory	9.11.0-r0
lucene-solrdebian	See advisory	0
org.apache.solr:solr-coremaven	>= 10.0.0, >= 9.4.0	9.8.1+sp999
seal.sp1.org.apache.solr:solr-coreseal	See advisory	9.8.1+sp999

Patched Releases

Solr

9.10.1, 10.0.0

org.apache.solr:solr-core

9.8.1+sp999

seal.sp1.org.apache.solr:solr-core

9.8.1+sp999

solr-9

9.11.0-r0

Timeline

Publicly disclosed
Jun 1, 2026
Added to Industry KEV feed
Jul 22, 2026
Last updated
Oct 8, 2026

Weakness Type

CWE-798 Use of Hard-coded Credentials
CWE-1188 Initialization of a Resource with an Insecure Default
CWE-1392 Use of Default Credentials

References

6 more references in the full CVE brief

FAQ

Common Questions.

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
Affected: Solr (Apache) versions 10.0.0, >= 9.4.0; solr-9 (chainguard); lucene-solr (debian), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Jul 22, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Solr 9.10.1, Solr 10.0.0, org.apache.solr:solr-core 9.8.1+sp999.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2026-44825 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.